Data protection policy

In accordance with Regulation (EU) 2016/679 of the Parliament and Council of 27 April 2016 on the protection of individuals with regard to the processing of their personal data and on the free movement of such data, and with Organic Law 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights, the Management of this CARLA SADE S.L. informs clients, users and the general public of the following

Introduction

This document constitutes CARLA SADE S.L.’s privacy policy with regard to the processing of its clients’ personal data. For any questions on this matter, the client can contact the Data Protection Officer with a postal address at ALAMEDA DEL CURA, 74, 11600 UBRIQUE, SPAIN. You can also contact the Data Protection Officer by sending an e-mail to the following address: cs@carlasade.com

Who is responsible for processing your data?

A) If you are a CARLA SADE S.L. user, the person responsible for processing your data is

B) If we have access to your data because you have requested information about any of the services and/or products offered through CARLA SADE S.L.’s web pages, the person responsible for processing your data is CARLA SADE S.L., with registered office at ALAMEDA DEL CURA, 74, 11600 UBRIQUE, SPAIN.

What personal data do we process and where do they come from?

The following categories of personal data may be processed in connection with your relationship with us:

• Customer identification and contact details (including signature, image,);
• Personal characteristics, social circumstances;
• Transactional data (payments, receipts, transfers, debits)

The data come from the interested party himself.

For what purpose do we process your personal data?

Personal data may be processed by data controllers for the following purposes: 1.- Provision of service: your personal data is processed in order to provide you with the required service, for example:

• Attend to any communication with CARLA SADE S.L;
• Manage any incident or claim filed by the client;
• To carry out surveys in order to know your opinion about the attention received and that will be used only to improve and develop our services;

2.- Attention to requests for information, complaints, suggestions, claims, exercise of data protection rights, etc: in these cases your data will be processed for the purpose of managing and processing the request, by any means, including telephone and/or electronic communications. 3.- Compliance with legal obligations: it may be necessary to process personal data in order to comply with the relevant legal requirements. In particular, to comply with data protection, tax, labour, etc. legislation. 4.- Formalisation and execution of the contract: the patient’s personal data are processed for the purpose of managing the contractual relationship with the customer. 5.- Sending commercial communications by any means in case of additional consent: If you explicitly consent, your data may be transferred for the purpose of informing you by any means for promotional and advertising purposes about restaurants, services, products or events related to CARLA SADE S.L. (in no case will your data be used to send you advertising content unrelated to CARLA SADE S.L.). The data collected will be processed for the purposes specified and in no case in a manner incompatible with those purposes. In any case, we treat your data to always serve you with the same level of quality, regardless of the channel you use to communicate with us (website, mobile applications either in person, by phone or telematically).

What is the legitimacy of the processing of your data?

How long will we keep your data?

In general, your data will only be kept for the time strictly necessary for the purpose for which it was collected. The personal data provided, as well as those derived from the commercial relationship, will be kept for the appropriate time in each case, and at least five years from the date the service is provided, unless regional and/or specific regulations establish a minimum retention period greater than that indicated, in which case the provisions of the applicable regulations will be complied with. Once this minimum period has been exceeded, and the commercial and contractual relationship has ended, the person responsible will keep your data duly blocked and pseudo-anonymised, for the duration of the periods corresponding to the legal prescription. The personal data provided for the purpose of managing any request for information, complaint, suggestion, claim, exercise of data protection rights, etc., will be kept for the time necessary to process the request, and in any case for the time legally established, as well as for the period necessary for the formulation, exercise or defence of claims. The data processed for the fulfilment of legal obligations will be kept for the time established in the applicable legislation. The data collected for the formalisation and execution of the contract will be kept for the duration of the contractual relationship, as well as for the period necessary for the formulation, exercise or defence of claims, at least five years. The data processed for sending commercial communications will be kept until the data subject revokes consent and/or exercises his or her rights of opposition and/or deletion.

To which recipients will your data be communicated?

In order to guarantee an adequate provision of the service, it is necessary that certain service providers and/or entities of the group that process data on behalf of the person responsible and as those in charge of processing their personal data. These entities may be, for example, auditing, physical security, archiving, storage or digitalisation of information, destruction of documentation, legal advisory services, IT services, etc. Your personal data will not be disclosed to third parties unless legally obliged to do so, unless it is in the vital interest of the data subject, or unless the data subject has given his or her consent. All information provided to us will be treated confidentially and in strict compliance with the necessary security obligations to prevent access by unauthorised third parties.

What are your rights when you provide us with your data?

You may exercise your rights of access; rectification of inaccurate data; request deletion, when, among other reasons, the data is no longer necessary for the purposes for which it was collected; under certain circumstances you may also request limitation of the processing of your data, in which case we will only keep it for the exercise or defence of claims; finally, and for reasons related to your particular situation, you may also exercise the right to object and the right to be transferred. You may also revoke, at any time, the consent given for the processing of your data. The exercise of the rights as well as the revocation of consent for the processing of your data is free of charge, except in the cases of Article 12.5 of Regulation (EU) 679/2016. If you are a client of CARLA SADE S.L., you may exercise your rights in person before the customer service department by sending a letter to “Customer Service” of your CARLA SADE S.L., with the reference “data protection rights”, providing a photocopy of your ID card or equivalent document and indicating the right you wish to exercise. We also inform you of the possibility of making a complaint to the competent control authority, in accordance with the procedure applicable in each case.